Update app
Update the settings, metadata, or status of an existing app on the Whop developer platform.
Required permissions:
developer:update_appdeveloper:manage_api_key
Authorizations
A company API key, company scoped JWT, app API key, or user OAuth token. You must prepend your key/token with the word 'Bearer', which will look like Bearer ***************************
Path Parameters
The unique identifier of the app to update, starting with 'app_'.
"app_xxxxxxxxxxxxxx"
Body
Parameters for UpdateApp
The detailed description shown on the app store's in-depth app view page.
The type of end-user the app is built for, such as consumer or business.
b2b_app, b2c_app, company_app, component The base production URL where the app is hosted, such as 'https://myapp.example.com'.
"https://example.com/path"
The URL path for the company dashboard view of the app, such as '/dashboard'.
A short description of the app shown in listings and search results.
The URL path for the discover view of the app, such as '/discover'.
The URL path for the member-facing hub view of the app, such as '/experiences/[experienceId]'.
The icon image for the app, used in listings and navigation.
The display name for the app, shown to users on the app store and product pages.
How this app authenticates at the OAuth token endpoint.
public, confidential The URL path to the OpenAPI spec file of the app, such as '/assets/openapi.json'.
The whitelisted OAuth callback URLs that users are redirected to after authorizing the app
Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text.
The permission scopes the app will request from users when they install it.
These are the scopes an app can request on behalf of a user
"read_user"The unique subdomain route where the app's hosted web builds are served, such as 'myapp' for myapp.whop.app.
Secrets to add or overwrite on the app, as an object of string values (e.g. {"MAIL_API_KEY": "..."}). Keys not included are left untouched. Pass null or an empty string as the value to delete a secret. Secrets are encrypted at rest and injected into the app's hosted server runtime as environment bindings.
The URL path to the skills directory of the app, such as '/assets/skills/'.
Controls the app's visibility. Set to 'live' to publish on Whop discovery (requires name, icon, and description). Set to 'unlisted' to hide from discovery while keeping the app accessible via direct link.
live, unlisted, hidden Response
A successful response
An app is an integration built on Whop. Apps can serve consumers as experiences within products, or serve companies as business tools.
The API key used to authenticate requests on behalf of this app. Null if no API key has been generated. Requires the 'developer:manage_api_key' permission.
The target audience classification for this app (e.g., 'b2b_app', 'b2c_app', 'company_app', 'component').
b2b_app, b2c_app, company_app, component The production base URL where the app is hosted. Null if no base URL is configured.
"https://myapp.example.com"
The company that owns and publishes this app.
The user who created and owns the company that published this app.
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The app's default API key, used to authenticate requests on behalf of this app. Null if the app has no default key. Requires the 'developer:manage_api_key' permission.
A written description of what this app does, displayed on the app store listing page. Null if no description has been set.
"A comprehensive analytics dashboard for tracking revenue, members, and growth metrics."
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The unique subdomain identifier for this app's proxied URL on the Whop platform. Forms the URL pattern https://{domain_id}.apps.whop.com.
"ab1c2d3e4f5g6h7i8j9k"
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The full canonical URL where this app's hosted web build is served. Null if the app has not claimed a route.
"https://myapp.whop.app"
The icon image for this app, displayed on the app store, product pages, checkout, and as the default icon for experiences using this app.
The unique identifier for the app.
"app_xxxxxxxxxxxxxx"
The approval status of this app's product listing on the Whop app store. Null if the app has no associated product.
not_available, pending_review, live_marketplace The display name of this app shown on the app store and in experience navigation. Maximum 30 characters.
"Courses"
How this app authenticates when exchanging OAuth authorization and refresh grants.
public, confidential The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The full origin URL for this app's proxied domain (e.g., 'https://myapp.apps.whop.com'). Null if no proxy domain is configured.
Represents a unique identifier that is Base64 obfuscated. It is often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "VXNlci0xMA==") or integer (such as 4) input value will be accepted as an ID.
The approved app build currently served to users on web. Null if no production build is deployed for web.
The whitelisted OAuth callback URLs that users are redirected to after authorizing the app.
Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text.
The list of permissions this app requests when installed, including both required and optional permissions with justifications.
The unique subdomain route where this app's hosted web builds are served, such as 'myapp' for myapp.whop.app. Null if the app has not claimed a route.
"myapp"
The app's secrets as an object of string values. Encrypted at rest and injected into the app's hosted server runtime as environment bindings. Requires the 'developer:update_app' permission.
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
Aggregate usage statistics for this app, including daily, weekly, and monthly active user counts.
The current visibility status of this app on the Whop app store. 'live' means publicly discoverable, 'unlisted' means accessible only via direct link, and 'hidden' means not visible anywhere.
live, unlisted, hidden Whether this app has been verified by Whop. Verified apps are endorsed by Whop and displayed in the featured apps section of the app store.

